would love to know how you sandbox and isolate the user-uploaded JS that runs serverside. how do you manage to do that safely? how protected is it against malicious js?